Chrome Profile — Safe Recovery, and a Phishing-Resistant Safe-Fix

Jacks-iMac · drwu · 2026-06-21 · Chrome 149.0.7827.115

Your data is 100% safe. Nothing was deleted, reset, or cleared. One 3-key pointer was repaired, with a dated backup beside it.

In plain words: Chrome was opening an empty practice copy of itself, so it looked logged out. Your real Chrome, with your passwords and tabs, was sitting safe the whole time. We just told Chrome to open the real one again.

What actually happened

Empty throwaway profile. Every running Chrome was launched by an automation harness with --user-data-dir=/tmp/chrome-kidtest-profile, a brand-new empty profile. Empty profile = no account = a Google sign-in page. It was being run by 5+ concurrent Claude sessions at once.
Degraded profile pointer. Chrome's Local State had last_used = (none) and last_active_profiles = [], so a normal launch did not cleanly resume your "Default" profile.
Ruled out: no enterprise policy, no Chrome Login Item, no duplicate Chrome.app, no bad shell alias, no crash. The Keychain "Chrome Safe Storage" key (which decrypts saved passwords) is present and intact.

Profile inventory — where your data lives

Folder	Display name	Account	Holds	State
Default	Person 1	7onething1@gmail.com	logins, autofill, history, cookies, extensions (13 MB), sessions	intact
Profile 1	heather	hsansom311@gmail.com	logins, bookmarks, history, sessions	intact
/tmp/chrome-kidtest-profile	—	none	nothing (automation scratch)	throwaway

Real user-data directory: ~/Library/Application Support/Google/Chrome/

The fix — minimal and reversible

Before
last_used = (none)
last_active_profiles = []

After
last_used = "Default"
last_active_profiles = ["Default"]

Changed

3 keys in Local State, re-serialized. Dated backup written first: Local State.bak-20260621-031057.

Left untouched (verified by unchanged mtime)

Login Data, History, Extensions, Cookies, Web Data, Sessions in Default and Profile 1; the Keychain key (existence-checked only, never read).

Undo & next step

Open normally: open -a "Google Chrome" (the browser is not auto-opened for you).
Still wrong? open -na "Google Chrome" --args --profile-directory=Default
Undo anytime: bash ~/Desktop/fix-chrome-profile-safe.sh --undo
Re-run the safe fix: bash ~/Desktop/fix-chrome-profile-safe.sh (refuses while Chrome is open, backs up, repairs only if drifted).
Stop the recurrence: do not run the kid-mode / ship headless-Chrome test from many sessions at once.

Productized: a phishing-resistant Safe-Fix guard

The same safety doctrine, turned into a tested library at ~/Projects/safe-fix-guard/ (stdlib only, 24 unit tests, exit 0).

Threat	Guard	Action
Phishing link (homograph, `user@host`, brand look-alike)	classify_url / link_text_mismatch	block / caution
Prompt injection in untrusted text	scan_for_prompt_injection	block
Credential exfiltration (read/decrypt secrets)	credential_guard	block
Destructive / USER-ACTIVE file op	file_op_guard	block
"Done" with no proof	require_proof_before_done	block until proof

Full spec: ~/Desktop/phish-product-world-class-plan.md · threat model, flows, failure modes, test cases, launch checklist.

Evidence: live ps args, ~/Library/Application Support/Google/Chrome/Local State, Keychain item presence, /tmp/phish_search.txt. Artifacts: ~/Desktop/chrome-profile-diagnosis.txt, ~/Desktop/fix-chrome-profile-safe.sh, ~/Desktop/phish-product-world-class-plan.md, ~/Projects/safe-fix-guard/.